CVE-2026-12313 is an information disclosure and sandbox escape vulnerability in the Security: Process Sandboxing component of Mozilla Firefox. This vulnerability allows an attacker to bypass sandbox restrictions, potentially exposing sensitive information. It was addressed and fixed in Firefox 152 and Firefox ESR 140.12, as documented in Mozilla security advisories MFSA 2026-57 and MFSA 2026-58. The CVSS v3.1 base score is 4.7 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. No known exploits in the wild have been reported. The fix is included in the official Mozilla releases Firefox 152 and ESR 140.12.

Successful exploitation of this vulnerability could lead to information disclosure and escape from the sandbox environment in Firefox, potentially allowing an attacker to access restricted data or perform actions outside the sandbox. However, the impact is limited to confidentiality and does not affect integrity or availability. The vulnerability requires user interaction and can be exploited remotely without privileges.

A fix is available and has been officially released by Mozilla in Firefox 152 and Firefox ESR 140.12. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to mitigate this vulnerability. No additional mitigation actions are indicated by the vendor advisory.